Content Organizer Rules overrides Folder level Permission

Question

We built a Sharepoint 2010 Document Center template site.

We have various folders under Document Library with Contribute rights to different group.

We use content organizer rules to route the document to appropriate folder by checking a metadata column (For ex If Department = HR, the document should go to Documents\HR Folder

All the Contributor groups have Contribute permission in DropOff Library.

The issue is, If someone from (Ex) "IT" dept enters meta data column values as "HR, It still uploads the document to HR Folder eventhough the IT user doesn't have Contributer permission to HR Folder.

Could someone help me how to restrict this?

I thought the document should route to DropOff library either the user tries to upload / Add a document to a folder where they dont have appropriate permission.

Thanks

Answer 1

Can your users access the document once it is moved to the new folder or are they denied access?

Although they don't have Contribute rights, I am wondering if they have some other permission that is allowing this? Maybe the Open permission: Open - Allows users to open a Web site, list, or folder in order to access items inside that container. Limited Access contains the Open permission.

Or, I wonder if the Content Organizer uses the SharePoint system account after the document hits the drop off library.

The Read Permission Level does grant the Open permission (as does the Contribute and Limited Access.)

Answer 2

Also i found the following answer here...

Any suggestions>?

http://www.scottjamison.com/blog/2010/11/the-sharepoint-2010-content-organizer/

Two of the questions I get regularly on the content organizer: Does a user need write permissions on the destination location? Answer: Actually, no! The content organizer will move the content to the new location whether or not the contributing user has access to the destination location. What account is used for the “Modified By” property on the destination document? Answer: The system will retain the original contributor. (The system does not mark the document as updated by ‘system’ or ‘admin’ or anything like that.)

Answer 3

OK, since the user doesn't need to have rights, I would look into implementing an approval process. Items can be forced through a content approval process prior to it being routed. I believe you would add the content approval to the drop off library. Check out the diagram from Microsoft